skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

api-authorization-and-bola

Detect broken object-level authorization in APIs across accounts and HTTP verbs.

2|Updated May 15, 2026
Search Tags:#api security#bola#mass assignment#id verification#broken authorization#nested resources#jwt testing
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill api-authorization-and-bola-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-authorization-and-bola
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/api-authorization-and-bola
Command: npx skills add https://github.com/lNwNl/Methodos --skill api-authorization-and-bola-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you detect broken authorization in APIs where object identifiers, nested resources, function endpoints, or hidden writable fields can be accessed or modified by users who should not have permission.

Core Features & Use Cases

  • BOLA-focused authorization testing: Validate object-level read/write/delete behavior by replaying requests across different accounts and tokens.
  • Nested resource coverage: Test parent/child authorization boundaries for endpoints like user invoices and other hierarchical routes.
  • Mass assignment and hidden field control: Identify privilege escalation via hidden JSON fields (e.g., role/org/verified/tier) and ensure updates reject unauthorized fields.
  • Method and route variant probing: Exercise alternate HTTP verbs and sibling endpoints to find inconsistently protected handlers.

Quick Start

Use this skill against the target API endpoints that take object IDs (including nested paths) by executing the test loop with two distinct accounts and comparing authorization outcomes.

Frequently Asked Questions about api-authorization-and-bola

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for broken object level authorization in APIs with nested resources?▼

Mass assignment risks are detected by probing hidden writable JSON fields like role, org, or tier across alternate HTTP verbs and sibling endpoints, verifying updates reject unauthorized fields during role-sensitive requests.

What is the best way to detect mass assignment and hidden field privilege escalation in APIs?▼

Mass assignment risks are detected by probing hidden writable JSON fields like role, org, or tier across alternate HTTP verbs and sibling endpoints, verifying updates reject unauthorized fields during role-sensitive requests.

Do I need two separate accounts to perform BOLA and BFLA authorization testing?▼

JWT testing for broken authorization involves replaying token-authenticated requests across different user roles to validate object-level access control and identify inconsistently protected handlers.

How does cross-account token replay validate object and field access across roles?▼

Mass assignment risks are detected by probing hidden writable JSON fields like role, org, or tier across alternate HTTP verbs and sibling endpoints, verifying updates reject unauthorized fields during role-sensitive requests.

Can this method probe alternate HTTP verbs and sibling endpoints for inconsistently protected handlers?▼

Mass assignment risks are detected by probing hidden writable JSON fields like role, org, or tier across alternate HTTP verbs and sibling endpoints, verifying updates reject unauthorized fields during role-sensitive requests.

Related Skills

Explore More Legal & Compliance Skills→
ok-helloworldok-helloworld
241

api-authorization-and-bola

Test API object ID and hidden field authorization across roles.

Community
Intermediate
0x1337c0d30x1337c0d3
3

api

Audit REST and RPC APIs against OWASP API Top 10 with CWE mappings.

Community
Advanced
Q16GQ16G
83

api-token-sec

Detect API token, CORS, and JWT security weaknesses in REST APIs.

Community
Intermediate
sayseven7sayseven7
11

api-authorization-and-bola

Detect broken API authorization controls on REST and GraphQL endpoints.

Community
Intermediate